title: Ensure No Unsupported Configuration Overrides are Used

platform: not ocp4-on-hypershift-hosted

description: |-
  OpenShift API servers should not use unsupported configuration overrides that
  can potentially compromise the security and stability of the cluster. This
  rule checks that no unsupported configuration overrides are present in the
  cluster API server configurations.

rationale: |-
  Unsupported configuration overrides can introduce security vulnerabilities,
  performance issues, and unexpected behaviors in the cluster. They bypass the
  standard configuration mechanisms and can potentially weaken the cluster's
  security posture or introduce instability.

severity: medium

identifiers:
  cce@ocp4: CCE-89950-0

references:
  cis@ocp4: 1.2.31

{{% set jqfilter = '[.items[] | select(.spec.unsupportedConfigOverrides != null and .spec.unsupportedConfigOverrides != {}) | .metadata.name]' %}}

ocil_clause: 'Unsupported OpenShift API server configuration overrides are detected'

ocil: |-
  Run the following commands to check for unsupported configuration overrides:
  <pre>$ oc get openshiftapiserver/cluster -o jsonpath='{.spec.unsupportedConfigOverrides}'</pre>
  Verify that these commands return an empty object or no output.

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/operator.openshift.io/v1/openshiftapiservers': jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: {{{ openshift_filtered_path('/apis/operator.openshift.io/v1/openshiftapiservers', jqfilter) }}}
    yamlpath: "[:]"
    check_existence: "none_exist"
    entity_check: "all"
    values:
      - value: "(.*?)"
        operation: "pattern match"
